View | Details | Raw Unified | Return to bug 39055
Collapse All | Expand All

(-)a/C4/Auth.pm (-1 / +2 lines)
Lines 195-201 sub get_template_and_user { Link Here
195
        $in->{query}->param( -name => 'koha_login_context', -values => ['sco'] );
195
        $in->{query}->param( -name => 'koha_login_context', -values => ['sco'] );
196
    } else {
196
    } else {
197
        my $request_method = $in->{query}->request_method // q{};
197
        my $request_method = $in->{query}->request_method // q{};
198
        unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) {
198
        unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) {
199
            for my $v (qw( login_userid login_password )) {
199
            for my $v (qw( login_userid login_password )) {
200
                $in->{query}->param( $v, '' )
200
                $in->{query}->param( $v, '' )
201
                    if $in->{query}->param($v);
201
                    if $in->{query}->param($v);
Lines 1415-1420 sub checkauth { Link Here
1415
            $uri->query_param_delete('login_userid');
1415
            $uri->query_param_delete('login_userid');
1416
            $uri->query_param_delete('login_password');
1416
            $uri->query_param_delete('login_password');
1417
            $uri->query_param_delete('koha_login_context');
1417
            $uri->query_param_delete('koha_login_context');
1418
            $uri->query_param_delete('login_op');
1418
            $uri->query_param_delete('op');
1419
            $uri->query_param_delete('op');
1419
            $uri->query_param_delete('csrf_token');
1420
            $uri->query_param_delete('csrf_token');
1420
            unless ( $params->{do_not_print} ) {
1421
            unless ( $params->{do_not_print} ) {
(-)a/C4/InstallAuth.pm (-1 / +1 lines)
Lines 111-117 sub get_template_and_user { Link Here
111
    my $template  = C4::Templates->new( $interface, $filename, $tmplbase, $query );
111
    my $template  = C4::Templates->new( $interface, $filename, $tmplbase, $query );
112
112
113
    my $request_method = $in->{query}->request_method // q{};
113
    my $request_method = $in->{query}->request_method // q{};
114
    unless ( $request_method eq 'POST' && $in->{query}->param('op') eq 'cud-login' ) {
114
    unless ( $request_method eq 'POST' && $in->{query}->param('login_op') eq 'cud-login' ) {
115
        $in->{query}->param( 'login_userid',   '' );
115
        $in->{query}->param( 'login_userid',   '' );
116
        $in->{query}->param( 'login_password', '' );
116
        $in->{query}->param( 'login_password', '' );
117
    }
117
    }
(-)a/Koha/Middleware/CSRF.pm (-1 / +1 lines)
Lines 68-74 sub call { Link Here
68
        # Get the CSRF token from the param list or the header
68
        # Get the CSRF token from the param list or the header
69
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
69
        my $csrf_token = $req->param('csrf_token') || $req->header('CSRF-TOKEN');
70
70
71
        if ( defined $req->param('op') && $original_op !~ m{^cud-} ) {
71
        if ( ( defined $req->param('op') && $original_op !~ m{^cud-} ) && !$req->param('login_op') ) {
72
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
72
            $error = sprintf "Programming error - op '%s' must start with 'cud-' for %s %s (referer: %s)", $original_op,
73
                $request_method, $uri, $referer;
73
                $request_method, $uri, $referer;
74
        } elsif ( !$csrf_token ) {
74
        } elsif ( !$csrf_token ) {
(-)a/catalogue/search.pl (-1 / +1 lines)
Lines 264-270 $template->param( advancedsearchesloop => $advancedsearchesloop ); Link Here
264
$template->param( searchid => scalar $cgi->param('searchid'), );
264
$template->param( searchid => scalar $cgi->param('searchid'), );
265
265
266
my $default_sort_by     = C4::Context->default_catalog_sort_by;
266
my $default_sort_by     = C4::Context->default_catalog_sort_by;
267
my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op');
267
my @sanitized_operators = $cgi->multi_param('op');                #NOTE: No longer sanitized...
268
268
269
# The following should only be loaded if we're bringing up the advanced search template
269
# The following should only be loaded if we're bringing up the advanced search template
270
if ( $template_type eq 'advsearch' ) {
270
if ( $template_type eq 'advsearch' ) {
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-4 / +2 lines)
Lines 160-169 Link Here
160
160
161
            <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" class="validated">
161
            <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" class="validated">
162
                [% INCLUDE 'csrf-token.inc' %]
162
                [% INCLUDE 'csrf-token.inc' %]
163
                <input type="hidden" name="op" value="cud-login" />
163
                <input type="hidden" name="login_op" value="cud-login" />
164
                <input type="hidden" name="koha_login_context" value="intranet" />
164
                <input type="hidden" name="koha_login_context" value="intranet" />
165
                [% FOREACH INPUT IN INPUTS %]
165
                [% FOREACH INPUT IN INPUTS %]
166
                    [% NEXT IF INPUT.name == "op" %]
167
                    [% NEXT IF INPUT.name == "csrf_token" %]
166
                    [% NEXT IF INPUT.name == "csrf_token" %]
168
                    [% NEXT IF INPUT.name == "koha_login_context" %]
167
                    [% NEXT IF INPUT.name == "koha_login_context" %]
169
                    [% NEXT IF INPUT.name == "branch" %]
168
                    [% NEXT IF INPUT.name == "branch" %]
Lines 254-263 Link Here
254
        [% ELSIF TwoFA_prompt %]
253
        [% ELSIF TwoFA_prompt %]
255
            <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off">
254
            <form action="[% script_name | html %]" method="post" name="loginform" id="loginform" autocomplete="off">
256
                [% INCLUDE 'csrf-token.inc' %]
255
                [% INCLUDE 'csrf-token.inc' %]
257
                <input type="hidden" name="op" value="cud-login" />
256
                <input type="hidden" name="login_op" value="cud-login" />
258
                <input type="hidden" name="koha_login_context" value="intranet" />
257
                <input type="hidden" name="koha_login_context" value="intranet" />
259
                [% FOREACH INPUT IN INPUTS %]
258
                [% FOREACH INPUT IN INPUTS %]
260
                    [% NEXT IF INPUT.name == "op" %]
261
                    [% NEXT IF INPUT.name == "csrf_token" %]
259
                    [% NEXT IF INPUT.name == "csrf_token" %]
262
                    [% NEXT IF INPUT.name == "koha_login_context" %]
260
                    [% NEXT IF INPUT.name == "koha_login_context" %]
263
                    [% NEXT IF INPUT.name == "branch" %]
261
                    [% NEXT IF INPUT.name == "branch" %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/auth.tt (-2 / +1 lines)
Lines 57-65 Link Here
57
57
58
                <form action="[% url | html %]" method="post" id="mainform">
58
                <form action="[% url | html %]" method="post" id="mainform">
59
                    [% INCLUDE 'csrf-token.inc' %]
59
                    [% INCLUDE 'csrf-token.inc' %]
60
                    <input type="hidden" name="op" value="cud-login" />
60
                    <input type="hidden" name="login_op" value="cud-login" />
61
                    [% FOREACH INPUT IN INPUTS %]
61
                    [% FOREACH INPUT IN INPUTS %]
62
                        [% NEXT IF INPUT.name == "op" %]
63
                        [% NEXT IF INPUT.name == "csrf_token" %]
62
                        [% NEXT IF INPUT.name == "csrf_token" %]
64
                        [% NEXT IF INPUT.name == "login_userid" %]
63
                        [% NEXT IF INPUT.name == "login_userid" %]
65
                        [% NEXT IF INPUT.name == "login_password" %]
64
                        [% NEXT IF INPUT.name == "login_password" %]
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (-1 / +1 lines)
Lines 508-514 Link Here
508
                                    [% PROCESS login_label for="muserid" %]<input type="text" id="muserid" name="login_userid" autocomplete="off" /> <label for="mpassword">Password:</label
508
                                    [% PROCESS login_label for="muserid" %]<input type="text" id="muserid" name="login_userid" autocomplete="off" /> <label for="mpassword">Password:</label
509
                                    ><input type="password" id="mpassword" name="login_password" autocomplete="off" />
509
                                    ><input type="password" id="mpassword" name="login_password" autocomplete="off" />
510
                                    <fieldset class="action">
510
                                    <fieldset class="action">
511
                                        <input type="hidden" name="op" value="cud-login" />
511
                                        <input type="hidden" name="login_op" value="cud-login" />
512
                                        <input type="submit" class="btn btn-primary" value="Log in" />
512
                                        <input type="submit" class="btn btn-primary" value="Log in" />
513
                                    </fieldset>
513
                                    </fieldset>
514
                                </div>
514
                                </div>
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-1 / +1 lines)
Lines 236-242 Link Here
236
                                [% END %]
236
                                [% END %]
237
                                <form action="[% form_action | html %]" name="auth" id="auth" method="post" autocomplete="off">
237
                                <form action="[% form_action | html %]" name="auth" id="auth" method="post" autocomplete="off">
238
                                    [% INCLUDE 'csrf-token.inc' %]
238
                                    [% INCLUDE 'csrf-token.inc' %]
239
                                    <input type="hidden" name="op" value="cud-login" />
239
                                    <input type="hidden" name="login_op" value="cud-login" />
240
                                    <input type="hidden" name="koha_login_context" value="opac" />
240
                                    <input type="hidden" name="koha_login_context" value="opac" />
241
241
242
                                    <div class="local-login">
242
                                    <div class="local-login">
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt (-1 / +1 lines)
Lines 202-208 Link Here
202
                                                <label for="password">Password:</label>
202
                                                <label for="password">Password:</label>
203
                                                <input class="form-control" type="password" id="password" name="login_password" autocomplete="off" />
203
                                                <input class="form-control" type="password" id="password" name="login_password" autocomplete="off" />
204
                                                <fieldset class="action">
204
                                                <fieldset class="action">
205
                                                    <input type="hidden" name="op" value="cud-login" />
205
                                                    <input type="hidden" name="login_op" value="cud-login" />
206
                                                    <input type="submit" value="Log in" class="btn btn-primary" />
206
                                                    <input type="submit" value="Log in" class="btn btn-primary" />
207
                                                </fieldset>
207
                                                </fieldset>
208
                                            </div>
208
                                            </div>
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-registration-confirmation.tt (-1 / +1 lines)
Lines 110-116 Link Here
110
                            <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
110
                            <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth" autocomplete="off">
111
                                [% INCLUDE 'csrf-token.inc' %]
111
                                [% INCLUDE 'csrf-token.inc' %]
112
                                <input type="hidden" name="koha_login_context" value="opac" />
112
                                <input type="hidden" name="koha_login_context" value="opac" />
113
                                <input type="hidden" name="op" value="cud-login" />
113
                                <input type="hidden" name="login_op" value="cud-login" />
114
                                <fieldset class="brief">
114
                                <fieldset class="brief">
115
                                    <legend>Log in to your account:</legend>
115
                                    <legend>Log in to your account:</legend>
116
                                    [% PROCESS login_label for="userid" %]
116
                                    [% PROCESS login_label for="userid" %]
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt (-1 / +1 lines)
Lines 363-369 Link Here
363
                                        [% FOREACH INPUT IN INPUTS %]
363
                                        [% FOREACH INPUT IN INPUTS %]
364
                                            <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
364
                                            <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" />
365
                                        [% END %]
365
                                        [% END %]
366
                                        <input type="hidden" name="op" value="cud-login" />
366
                                        <input type="hidden" name="login_op" value="cud-login" />
367
                                    </fieldset>
367
                                    </fieldset>
368
                                </form>
368
                                </form>
369
                                <!-- /#mainform -->
369
                                <!-- /#mainform -->
(-)a/opac/opac-tags.pl (-2 / +1 lines)
Lines 122-128 unless ( C4::Context->preference('TagsEnabled') ) { Link Here
122
122
123
if ($add_op) {
123
if ($add_op) {
124
    unless ($loggedinuser) {
124
    unless ($loggedinuser) {
125
        push @errors, { +'cud-login' => 1 };
125
        push @errors, { +'login' => 1 };
126
        push @globalErrorIndexes, $#errors;
126
        push @globalErrorIndexes, $#errors;
127
        %newtags = ();    # zero out any attempted additions
127
        %newtags = ();    # zero out any attempted additions
128
        @deltags = ();    # zero out any attempted deletions
128
        @deltags = ();    # zero out any attempted deletions
129
- 

Return to bug 39055